From 54a4af798b1fc886f0ee908c83b62e5e512835f5 Mon Sep 17 00:00:00 2001 From: Lorenzo Fontana Date: Mon, 23 Nov 2020 11:59:39 +0100 Subject: [PATCH] new: initial docsy porting Co-Authored-By: Leonardo Di Donato Signed-off-by: Lorenzo Fontana --- .gitmodules | 6 +- assets/icons/logo.svg | 115 +++++++++++++++++ assets/scss/_nav.scss | 116 ++++++++++++++++++ assets/scss/_variables_project.scss | 2 + config.yaml | 20 ++- content/en/docs/configuration/_index.md | 5 +- .../en/docs/event-sources/sample-events.md | 7 +- content/en/docs/getting-started/download.md | 7 +- .../en/docs/getting-started/installation.md | 4 +- content/en/docs/getting-started/running.md | 24 ++-- .../en/docs/getting-started/third-party.md | 8 +- content/en/docs/rules/_index.md | 4 +- content/jp/docs/changelog.md | 2 +- content/jp/docs/configuration.md | 4 +- content/jp/docs/download.md | 4 +- .../jp/docs/event-sources/sample-events.md | 7 +- content/jp/docs/installation.md | 4 +- content/jp/docs/rules/_index.md | 14 ++- content/jp/docs/running.md | 18 ++- content/jp/docs/third-party.md | 5 +- content/ko/docs/configuration.md | 8 +- content/ko/docs/download.md | 4 +- content/ko/docs/installation.md | 5 +- content/ko/docs/rules/_index.md | 4 +- content/ko/docs/third-party.md | 4 +- layouts/partials/navbar.html | 33 +++++ .../shortcodes/changelog.html | 0 .../layouts => layouts}/shortcodes/cheat.html | 0 .../shortcodes/cheatsheet.html | 0 .../shortcodes/config.html | 0 .../shortcodes/githubcode.html | 0 .../shortcodes/latest.html | 0 .../shortcodes/requirement.html | 0 .../shortcodes/sha256sum.html | 0 themes/docsy | 1 + .../layouts/shortcodes/danger.html | 1 - .../falco-fresh/layouts/shortcodes/info.html | 1 - .../layouts/shortcodes/success.html | 1 - .../layouts/shortcodes/warning.html | 1 - 39 files changed, 360 insertions(+), 79 deletions(-) create mode 100644 assets/icons/logo.svg create mode 100644 assets/scss/_nav.scss create mode 100644 assets/scss/_variables_project.scss create mode 100644 layouts/partials/navbar.html rename {themes/falco-fresh/layouts => layouts}/shortcodes/changelog.html (100%) rename {themes/falco-fresh/layouts => layouts}/shortcodes/cheat.html (100%) rename {themes/falco-fresh/layouts => layouts}/shortcodes/cheatsheet.html (100%) rename {themes/falco-fresh/layouts => layouts}/shortcodes/config.html (100%) rename {themes/falco-fresh/layouts => layouts}/shortcodes/githubcode.html (100%) rename {themes/falco-fresh/layouts => layouts}/shortcodes/latest.html (100%) rename {themes/falco-fresh/layouts => layouts}/shortcodes/requirement.html (100%) rename {themes/falco-fresh/layouts => layouts}/shortcodes/sha256sum.html (100%) create mode 160000 themes/docsy delete mode 100644 themes/falco-fresh/layouts/shortcodes/danger.html delete mode 100644 themes/falco-fresh/layouts/shortcodes/info.html delete mode 100644 themes/falco-fresh/layouts/shortcodes/success.html delete mode 100644 themes/falco-fresh/layouts/shortcodes/warning.html diff --git a/.gitmodules b/.gitmodules index 490a262a5..ed7f0d76c 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,3 @@ -[submodule "public"] - path = public - url = https://github.com/falcosecurity/falcosecurity.github.io +[submodule "themes/docsy"] + path = themes/docsy + url = https://github.com/google/docsy diff --git a/assets/icons/logo.svg b/assets/icons/logo.svg new file mode 100644 index 000000000..8559228a8 --- /dev/null +++ b/assets/icons/logo.svg @@ -0,0 +1,115 @@ + + + + + + image/svg+xml + + + + + + + + + Falco horizontal logo_teal2 + + + + + + + + + + + + + + diff --git a/assets/scss/_nav.scss b/assets/scss/_nav.scss new file mode 100644 index 000000000..486abf641 --- /dev/null +++ b/assets/scss/_nav.scss @@ -0,0 +1,116 @@ +.td-navbar-cover { + background: $primary; + + @include media-breakpoint-up(md) { + background: transparent !important; + + .nav-link { + text-shadow: 1px 1px 2px $dark; + } + + .brand-name { + display: none;} + + } + + &.navbar-bg-onscroll .nav-link { + text-shadow: none; + } +} + +.navbar-bg-onscroll { + background: $primary !important; + opacity: inherit; +} + +.td-navbar { + background: $primary; + min-height: 4rem; + margin: 0; + z-index: 32; + + .brand-name { + display: none;} + + @include media-breakpoint-up(md) { + position: fixed; + top: 0; + width: 100%; + } + + .navbar-brand { + text-transform: none; + text-align: middle; + margin: 0; + padding: 0; + + .nav-link { + display: inline-block; + margin-right: -30px; + } + + .navbar-logo { + svg { + display: inline-block; + position: absolute; + top: 0; + left: 5px; + z-index: 33; + padding: 10px; + height: 65px; + width: 200px; + + @include media-breakpoint-down(md) { + left: 16px; + width: 80px; + height: auto; + padding: 6px; + } + } + } + } + + .nav-link { + text-transform: none; + font-weight: $font-weight-bold; + } + + .td-search-input { + border: none; + + @include placeholder { + color: $navbar-dark-color; + } + } + + .dropdown { + min-width: 100px; + } + + @include media-breakpoint-down(md) { + padding-right: .5rem; + padding-left: .75rem; + align-items: flex-end; + + .td-navbar-nav-scroll { + max-width: calc(100% + .75rem - 96px - 1.5rem); + height: 2.5rem; + margin-top: .25rem; + overflow: hidden; + font-size: .875rem; + + .nav-link { + padding-right: .25rem; + padding-left: 0; + } + + .navbar-nav { + margin-top: 0 !important; + padding-bottom: 2rem; + overflow-x: auto; + white-space: nowrap; + -webkit-overflow-scrolling: touch; + } + } + } +} diff --git a/assets/scss/_variables_project.scss b/assets/scss/_variables_project.scss new file mode 100644 index 000000000..48c2537e9 --- /dev/null +++ b/assets/scss/_variables_project.scss @@ -0,0 +1,2 @@ +$primary: #00aec7; +$secondary: #53565a; diff --git a/config.yaml b/config.yaml index 02fdf9575..eaf9044e5 100644 --- a/config.yaml +++ b/config.yaml @@ -1,6 +1,6 @@ baseURL: / languageCode: en-us -theme: falco-fresh +theme: docsy disableKinds: ["taxonomy", "taxonomyTerm"] pygmentsCodefences: true pygmentsStyle: monokai @@ -482,8 +482,26 @@ languages: params: version: v0.26.2 + githubRepository : falcosecurity/falco sha256sum: 21e8053c37e32f95d91c9393d961af1c63b5839d795c8cac314d05daadea9779 + offlineSearch: true + ui: + navbar_logo: true + sidebar_search_disable: false + sidebar_menu_compact: false + breadcrumb_disable: false + feedback: + enable: true + 'yes': >- + Glad to hear it! Please tell us how we + can improve. + 'no': >- + Sorry to hear that. Please tell us how we + can improve. + primaryFont: name: "Karla" sizes: [400 700] diff --git a/content/en/docs/configuration/_index.md b/content/en/docs/configuration/_index.md index 7b83441ea..871361f41 100644 --- a/content/en/docs/configuration/_index.md +++ b/content/en/docs/configuration/_index.md @@ -5,13 +5,12 @@ weight: 3 notoc: true --- -{{< info >}} - +{{% pageinfo color="primary" %}} This is for the Falco daemon configuration options. Please visit [rules](../rules) or [alerts](../alerts) for those options. -{{< /info >}} +{{% /pageinfo %}} Falco's configuration file is a [YAML](http://www.yaml.org/start.html) file containing a collection of `key: value` or `key: [value list]` pairs. diff --git a/content/en/docs/event-sources/sample-events.md b/content/en/docs/event-sources/sample-events.md index 8b1239b28..31f7e539a 100644 --- a/content/en/docs/event-sources/sample-events.md +++ b/content/en/docs/event-sources/sample-events.md @@ -24,11 +24,10 @@ The full command line documentation is [here](https://github.com/falcosecurity/e ### System Call Activity -{{< info >}} - +{{% pageinfo color="primary" %}} **Warning** — We strongly recommend that you run the program within Docker (see below), since some commands might alter your system. For example, some actions modify files and directories below `/bin`, `/etc`, `/dev`, etc. -{{< /info >}} +{{% /pageinfo %}} The `syscall` collection performs a variety of suspect actions that are detected by the [default Falco ruleset](https://github.com/falcosecurity/falco/blob/master/rules/falco_rules.yaml). @@ -69,4 +68,4 @@ kubectl apply -f deployment/role-rolebinding-serviceaccount.yaml \ The above command applies to the default namespace. Use the `--namespace` option to deploy in a different namespace. Events will be generated in the same namespace. -You can also find more examples in the repository [documentation](https://github.com/falcosecurity/event-generator#with-kubernetes). \ No newline at end of file +You can also find more examples in the repository [documentation](https://github.com/falcosecurity/event-generator#with-kubernetes). diff --git a/content/en/docs/getting-started/download.md b/content/en/docs/getting-started/download.md index f228bd20b..3a1c26aff 100644 --- a/content/en/docs/getting-started/download.md +++ b/content/en/docs/getting-started/download.md @@ -28,8 +28,7 @@ The list of all available artifacts can be found [here](https://bintray.com/falc ### Download container images {#images} -{{< info >}} - +{{% pageinfo color="primary" %}} Falco depends on having a driver installed on the host system to get information about the running system calls. The preferred installation method is to install the driver using the native artifacts defined above or @@ -37,7 +36,7 @@ temporarily run the `falcosecurity/falco-driver-loader` image as privileged, the For more details, see the [Run within Docker section](/docs/getting-started/running#docker). -{{< /info >}} +{{% /pageinfo %}} |tag | pull command | description | |----|----------|-----------------| @@ -55,4 +54,4 @@ The list of all available images can be found [here](https://github.com/falcosec [3]: https://dl.bintray.com/falcosecurity/deb-dev/stable [4]: https://dl.bintray.com/falcosecurity/deb/stable [5]: https://dl.bintray.com/falcosecurity/bin-dev/x86_64 -[6]: https://dl.bintray.com/falcosecurity/bin/x86_64 \ No newline at end of file +[6]: https://dl.bintray.com/falcosecurity/bin/x86_64 diff --git a/content/en/docs/getting-started/installation.md b/content/en/docs/getting-started/installation.md index 720420511..beeb4c2cd 100644 --- a/content/en/docs/getting-started/installation.md +++ b/content/en/docs/getting-started/installation.md @@ -6,14 +6,14 @@ weight: 3 Falco is a Linux security tool that uses system calls to secure and monitor a system. -{{< info >}} +{{% pageinfo color="primary" %}} Falco can be used for Kubernetes runtime security. The most secure way to run Falco is to install Falco directly on the host system so that Falco is isolated from Kubernetes in the case of compromise. Then the Falco alerts can be consumed via read-only agents running in Kubernetes. Falco can also be ran directly in Kubernetes if isolation is not a concern. If you would like to run Falco directly in Kubernetes with a tool like Kind, Minikube, or Helm please see the [third party integrations](../third-party) -{{< /info >}} +{{% /pageinfo %}} If Falco is installed using the package manager artifacts below, you will have the following in place: diff --git a/content/en/docs/getting-started/running.md b/content/en/docs/getting-started/running.md index eb0618c6c..1460cb0d3 100644 --- a/content/en/docs/getting-started/running.md +++ b/content/en/docs/getting-started/running.md @@ -33,21 +33,23 @@ If you'd like to run Falco by hand, you can find the full usage description for falco --help ``` -{{< info >}} +{{% pageinfo color="primary" %}} Are you looking for userpace instrumentation? Please see [this page](/docs/event-sources/drivers/). -{{< /info >}} +{{% /pageinfo %}} + ## Run within Docker {#docker} -{{< info >}} + +{{% pageinfo color="primary" %}} Even using container images, Falco needs kernel headers installed on the host as prerequisite to correctly build the driver (the [kernel module](/docs/event-sources/drivers/#kernel-module) or the [eBPF probe](/docs/event-sources/drivers/#ebpf-probe)) on the fly. This step is not needed when a prebuilt driver is already available. You can find instructions on how to install the kernel headers for your system under the [Install section](/docs/getting-started/installation). -{{< /info >}} +{{% /pageinfo %}} Falco ships a set of official [docker images](/docs/getting-started/download#images). The images can be used in two ways as follows: @@ -57,7 +59,8 @@ The images can be used in two ways as follows: ### Least privileged (recommended) {#docker-least-privileged} -{{< info >}} + +{{% pageinfo color="primary" %}} You cannot use the Least privileged mode with the eBPF probe driver unless you have at least Kernel 5.8, this is because `--privileged` is needed to do the `bpf` syscall. @@ -66,7 +69,7 @@ and ignore the Install the kernel module section completely. You can read more details about this [here](https://github.com/falcosecurity/falco/issues/1299#issuecomment-653448207) -{{< /info >}} +{{% /pageinfo %}} This is how the Falco userspace process can be ran in a container. @@ -106,8 +109,8 @@ You can find more about its usage [here](/docs/getting-started/installation#inst falcosecurity/falco-no-driver:latest ``` -{{< warning >}} +{{% pageinfo color="warning" %}} If you are running Falco on a system with the AppArmor LSM enabled (e.g Ubuntu), you will also need to pass `--security-opt apparmor:unconfined` to the `docker run` command above. @@ -117,13 +120,14 @@ You can verify if you have AppArmor enabled using the command below: docker info | grep -i apparmor ``` -{{< /warning >}} +{{% /pageinfo %}} + -{{< info >}} +{{% pageinfo color="primary" %}} Note that `ls /dev/falco* | xargs -I {} echo --device {}` outputs a `--device /dev/falcoX` option per CPU (ie. just the devices created by the Falco's kernel module). Also, `-e HOST_ROOT=/` is necessary since with `--device` there is no way to remap devices to `/host/dev/`. -{{< /info >}} +{{% /pageinfo %}} ### Fully privileged {#docker-privileged} diff --git a/content/en/docs/getting-started/third-party.md b/content/en/docs/getting-started/third-party.md index c570ba0ef..2729bbe80 100644 --- a/content/en/docs/getting-started/third-party.md +++ b/content/en/docs/getting-started/third-party.md @@ -102,11 +102,9 @@ Falco can use eBPF with minimal configuration changes. To do so, set the `FALCO_ eBPF is currently supported only on GKE and COS, however here we provide installation details for a wider set of platforms -{{< info >}} - +{{% pageinfo color="primary" %}} If you want to specify an alternative path for the probe file, you can also set `FALCO_BPF_PROBE` to the path of an existing eBPF probe. - -{{< /info >}} +{{% /pageinfo %}} When using the official container images, setting this environment variable will trigger the `falco-driver-loader` script to download the kernel headers for the appropriate version of COS, and then compile the appropriate eBPF probe. In all the other environments you can call the `falco-driver-loader` script yourself to obtain it in this way: @@ -136,4 +134,4 @@ If you are [installing Falco with Helm](https://falco.org/docs/third-party/#helm ``` helm install falco falcosecurity/falco --set ebpf.enabled=true -``` \ No newline at end of file +``` diff --git a/content/en/docs/rules/_index.md b/content/en/docs/rules/_index.md index b8348085e..58515bb43 100644 --- a/content/en/docs/rules/_index.md +++ b/content/en/docs/rules/_index.md @@ -15,9 +15,9 @@ Element | Description From time to time, we make changes to the rules file format that are not backwards-compatible with older versions of Falco. Similarly, the Sysdig libraries incorporated into Falco may define new filtercheck fields, operators, etc. We want to denote that a given set of rules depends on the fields/operators from those Sysdig libraries. -{{< info >}} +{{% pageinfo color="primary" %}} As of Falco version **0.14.0**, the Falco rules support explicit versioning of both the Falco engine and the Falco rules file. -{{< /info >}} +{{% /pageinfo %}} ### Falco Engine Versioning diff --git a/content/jp/docs/changelog.md b/content/jp/docs/changelog.md index ea49936b6..ef89126f6 100644 --- a/content/jp/docs/changelog.md +++ b/content/jp/docs/changelog.md @@ -3,4 +3,4 @@ title: 変更履歴 notoc: true --- -{{< changelog "https://api.github.com/repos/falcosecurity/falco/releases" >}} +TODO changelog diff --git a/content/jp/docs/configuration.md b/content/jp/docs/configuration.md index 3aaa3836f..cca79cba2 100644 --- a/content/jp/docs/configuration.md +++ b/content/jp/docs/configuration.md @@ -5,13 +5,13 @@ weight: 4 notoc: true --- -{{< info >}} +{{% pageinfo color="primary" %}} これはFalcoデーモンの設定オプションのためのものです。 これらのオプションについては、[rules](/jp/docs/rules)または[alerts](/jp/docs/alerts)を参照してください。 -{{< /info >}} +{{% /pageinfo %}} Falcoの設定ファイルは[YAML](http://www.yaml.org/start.html)ファイルで、`key: value` または `key: [value list]` のペアのコレクションを含むファイルです。 diff --git a/content/jp/docs/download.md b/content/jp/docs/download.md index 50f15570f..461525ce6 100644 --- a/content/jp/docs/download.md +++ b/content/jp/docs/download.md @@ -28,7 +28,7 @@ Falcoプロジェクトコミュニティは、Falcoをダウンロードして ### Download container images {#images} -{{< info >}} +{{% pageinfo color="primary" %}} Falcoは、実行中のシステムコールに関する情報を取得するために、ホストシステムにドライバーをインストールすることに依存しています。 @@ -37,7 +37,7 @@ Falcoは、実行中のシステムコールに関する情報を取得するた 詳細については、[Dockerセクション内で実行](/docs/getting-started/running#docker)を参照してください。 -{{< /info >}} +{{% /pageinfo %}} |tag | pull command | description | |----|----------|-----------------| diff --git a/content/jp/docs/event-sources/sample-events.md b/content/jp/docs/event-sources/sample-events.md index 212bb7f15..178a38416 100644 --- a/content/jp/docs/event-sources/sample-events.md +++ b/content/jp/docs/event-sources/sample-events.md @@ -24,11 +24,10 @@ event-generator run [regexp] ### システムコールアクティビティ -{{< info >}} - +{{% pageinfo color="primary" %}} **注意** — 一部のコマンドはシステムを変更する可能性があるため、Docker(下記参照)内でプログラムを実行することを強くお勧めします。たとえば、一部のアクションは、`/bin`, `/etc`, `/dev`などの下のファイルとディレクトリを変更します。 -{{< /info >}} +{{% /pageinfo %}} `syscall`コレクションは、[デフォルトのFalcoルールセット](https://github.com/falcosecurity/falco/blob/master/rules/falco_rules.yaml)によって検出されるさまざまな疑わしいアクションを実行します。 @@ -69,4 +68,4 @@ kubectl apply -f deployment/role-rolebinding-serviceaccount.yaml \ 上記のコマンドは、デフォルトのネームスペースに適用されます。 別のネームスペースにデプロイするには、`--namespace`オプションを使用します。 イベントは同じネームスペースで生成されます。 -リポジトリ[ドキュメント](https://github.com/falcosecurity/event-generator#with-kubernetes)には、他の例もあります。 \ No newline at end of file +リポジトリ[ドキュメント](https://github.com/falcosecurity/event-generator#with-kubernetes)には、他の例もあります。 diff --git a/content/jp/docs/installation.md b/content/jp/docs/installation.md index c632c0faf..37a44c90d 100644 --- a/content/jp/docs/installation.md +++ b/content/jp/docs/installation.md @@ -6,14 +6,14 @@ weight: 3 Falcoは、システムコールを使用してシステムを保護および監視するLinuxセキュリティツールです。 -{{< info >}} +{{% pageinfo color="primary" %}} FalcoはKubernetesランタイムセキュリティに使用できます。 Falcoを実行する最も安全な方法は、ホストシステムにFalcoを直接インストールすることです。これにより、侵害された場合にFalcoがKubernetesから分離されます。 その後、Falcoアラートは、Kubernetesで実行されている読み取り専用エージェントを介して使用できます。 分離が問題にならない場合は、FalcoをKubernetesで直接実行することもできます。 Kind、Minikube、Helmなどのツールを使用してKubernetesで直接Falcoを実行する場合は、[サードパーティ統合](../third-party)をご覧ください。 -{{< /info >}} +{{% /pageinfo %}} 以下のパッケージマネージャーアーティファクトを使用してFalcoがインストールされている場合は、次のものが用意されています: diff --git a/content/jp/docs/rules/_index.md b/content/jp/docs/rules/_index.md index 402107c5a..5400dbf49 100644 --- a/content/jp/docs/rules/_index.md +++ b/content/jp/docs/rules/_index.md @@ -15,9 +15,9 @@ Falco *ルールファイル*は、3種類の要素を含む[YAML](http://www.ya 時々、古いバージョンのFalcoとの下位互換性がないルールファイル形式に変更を加えます。同様に、Falcoに組み込まれたSysdigライブラリは、新しいfiltercheckフィールド、演算子などを定義する場合があります。特定のルールセットは、それらのSysdigライブラリのフィールド/演算子に依存することを示します。 -{{< info >}} +{{% pageinfo color="primary" %}} Falcoバージョン** 0.14.0 **以降、Falcoルールは、FalcoエンジンとFalcoルールファイルの両方の明示的なバージョン管理をサポートしています。 -{{< /info >}} +{{% /pageinfo %}} ### Falcoエンジンのバージョン管理 @@ -57,9 +57,10 @@ container.id != host and proc.name = bash 最初の句は、イベントがコンテナで発生したことを確認します(Sysdigイベントには、イベントが通常のホストで発生した場合、`"host"`に等しい`container`フィールドがあります)。 2番目の句は、プロセス名が`bash`であることを確認します。この条件には、システムコールの句も含まれていないことに注意してください。イベントのメタデータのみをチェックします。そのため、bashシェルがコンテナー内で起動した場合、Falcoはそのシェルによって実行されるすべてのsyscallに対してイベントを出力します。 -{{< success >}} +{{% pageinfo color="primary" %}} Sysdigが初めてで、どのフィールドが利用可能かわからない場合は、 `sysdig -l`を実行して、サポートされているフィールドのリストを確認してください。 -{{< /success >}} +{{% /pageinfo %}} + 上記の条件を使用した完全なルールは次のようになります： @@ -111,9 +112,10 @@ Key | 説明 リストを参照すると、マクロ、ルール、またはリストにリスト項目が挿入されます。 -{{< success >}} +{{% pageinfo color="primary" %}} リストには他のリストを含めることが*できます*。 -{{< /success >}} +{{% /pageinfo %}} + ## リスト、ルール、マクロへの追加 diff --git a/content/jp/docs/running.md b/content/jp/docs/running.md index 813c57a00..8dc371229 100644 --- a/content/jp/docs/running.md +++ b/content/jp/docs/running.md @@ -33,11 +33,10 @@ journalctl -fu falco falco --help ``` -{{< info >}} - +{{% pageinfo color="primary" %}} ユーザースペースのインストルメントをお探しですか？[このページ](/docs/event-sources/drivers/)をご覧ください。 -{{< /info >}} +{{% /pageinfo %}} ## Dockerでの実行 {#docker} @@ -49,7 +48,7 @@ Falcoは公式の[docker images](/docs/getting-started/download#images)のセッ ### 最少特権（推奨） {#docker-least-privileged} -{{< info >}} +{{% pageinfo color="primary" %}} 少なくともKernel 5.8以上でないと、eBPFプローブドライバでLeast privilegedモードを使用することはできません。 これは `--privileged` が `bpf` のシステムコールを行うために必要だからです。 @@ -57,7 +56,7 @@ Kernel >= 5.8 を実行している場合は、ステップ 2 の docker run コ そして、カーネルモジュールのインストールセクションは完全に無視してください。 詳しくはこちらをご覧ください[こちら](https://github.com/falcosecurity/falco/issues/1299#issuecomment-653448207) -{{< /info >}} +{{% /pageinfo %}} このようにして、Falco ユーザスペースプロセスをコンテナ内で実行することができます。 @@ -96,8 +95,7 @@ Kernel >= 5.8 を実行している場合は、ステップ 2 の docker run コ falcosecurity/falco-no-driver:latest ``` -{{< warning >}} - +{{% pageinfo color="warning" %}} AppArmor LSMを有効にしたシステム（例：Ubuntu）でFalcoを実行している場合、`--security-opt apparmor:unconfined`を次のように渡す必要があります。 上記の `docker run` コマンドを実行します。 @@ -107,13 +105,13 @@ AppArmorが有効になっているかどうかは、以下のコマンドを使 docker info | grep -i apparmor ``` -{{< /warning >}} +{{% /pageinfo %}} -{{< info >}} +{{% pageinfo color="primary" %}} `ls /dev/falco* | xargs -I {} echo --device {}` は CPU ごとに `--dev/dev/falcoX` オプションを出力することに注意してください (つまり、Falco のカーネルモジュールによって作成されたデバイスだけです)。 -{{< /info >}} +{{% /pageinfo %}} ### 完全特権 {#docker-privileged} diff --git a/content/jp/docs/third-party.md b/content/jp/docs/third-party.md index 0338f59e5..2afd3b64b 100644 --- a/content/jp/docs/third-party.md +++ b/content/jp/docs/third-party.md @@ -98,11 +98,10 @@ Falcoは最小限の設定変更でeBPFを使用できます。 これを行う eBPFは現在、GKEとCOSでのみサポートされていますが、ここでは幅広いプラットフォームセットのインストールの詳細を提供します -{{< info >}} - +{{% pageinfo color="primary" %}} プローブファイルの代替パスを指定する場合は、`FALCO_BPF_PROBE`を既存のeBPFプローブのパスに設定することもできます。 -{{< /info >}} +{{% /pageinfo %}} 公式のコンテナイメージを使用する場合、この環境変数を設定すると、`falco-driver-loader`スクリプトがトリガーされ、適切なバージョンのCOSのカーネルヘッダーがダウンロードされ、適切なeBPFプローブがコンパイルされます。他のすべての環境では、`falco-driver-loader`スクリプトを自分で呼び出して、次の方法で取得できます: diff --git a/content/ko/docs/configuration.md b/content/ko/docs/configuration.md index 9651e7fae..64c688faf 100644 --- a/content/ko/docs/configuration.md +++ b/content/ko/docs/configuration.md @@ -5,13 +5,14 @@ weight: 5 notoc: true --- -{{< info >}} +{{% pageinfo color="primary" %}} 이 문서는 팔코 데몬 구성 옵션을 위한 것이다. 이들 옵션을 보려면 [규칙](/docs/rules) 또는 [경고](/docs/alerts)를 확인한다. -{{< /info >}} +{{% /pageinfo %}} + 팔코의 구성 파일은 `key: value` 또는 `key: [value list]` 쌍의 모음을 포함하는 [YAML](http://www.yaml.org/start.html) 파일이다. @@ -24,4 +25,5 @@ notoc: true [comment]: <> (@kris-nova: This data is loaded from the YAML file in data/ko/config.yaml) -{{< config >}} + +TODO-PRINT-CONFIG diff --git a/content/ko/docs/download.md b/content/ko/docs/download.md index 4542719da..df50dff34 100644 --- a/content/ko/docs/download.md +++ b/content/ko/docs/download.md @@ -27,7 +27,7 @@ weight: 2 ### 컨테이너 이미지 다운로드 {#images} -{{< info >}} +{{% pageinfo color="primary" %}} 팔코는 실행 중인 시스템 호출 정보를 얻기 위해 호스트 시스템에 드라이버를 설치해야 한다. @@ -35,7 +35,7 @@ weight: 2 자세한 내용은 [Docker 섹션 내에서 실행](https://falco.org/docs/getting-started/running/#docker)을 참고한다. -{{< /info >}} +{{% /pageinfo %}} |tag | pull command | description | |----|----------|-----------------| diff --git a/content/ko/docs/installation.md b/content/ko/docs/installation.md index 0b210d00f..85f426f8f 100644 --- a/content/ko/docs/installation.md +++ b/content/ko/docs/installation.md @@ -6,14 +6,15 @@ weight: 3 팔코는 시스템 호출을 이용해 시스템을 모니터링하고 보호하는 리눅스 보안 도구이다. -{{< info >}} +{{% pageinfo color="primary" %}} 팔코는 쿠버네티스 런타임 보안에 사용할 수 있다. 팔코를 설치하는 가장 안전한 방법은 시스템 손상 시 팔코와 쿠버네티스가 격리되도록 호스트 시스템에 직접 설치하는 것이다. 그 다음 팔코 알림은 쿠버네티스에서 실행되는 읽기 전용 에이전트를 통해 사용할 수 있다. 격리가 문제가 되지 않는 경우에는 팔코를 쿠버네티스에서 직접 실행할 수 있다. Kind, Minikube, Helm 같은 도구를 이용해 팔코를 쿠버네티스에서 직접 실행하는 방법은 [써드파티 통합](https://falco.org/docs/third-party/)을 참고한다. -{{< /info >}} +{{% /pageinfo %}} + 아래의 패키지 관리 아티팩트를 이용해 팔코를 설치한 경우에는 다음이 준비되어 있다. diff --git a/content/ko/docs/rules/_index.md b/content/ko/docs/rules/_index.md index 28cb0dd33..4ca6b9b35 100644 --- a/content/ko/docs/rules/_index.md +++ b/content/ko/docs/rules/_index.md @@ -15,9 +15,9 @@ weight: 2 때때로, 우리는 이전 버전의 팔코와 호환되지 않는 규칙 파일의 형식을 변경한다. 마찬가지로 팔코에 통합된 Sysdig 라이브러리는 새로운 필터 검사 필드, 연산자 등을 정의할 수 있다. 주어진 규칙 세트는 해당 Sysdig 라이브러리의 필드/연산자에 따라 다르다는 뜻이다. -{{< info >}} +{{% pageinfo color="primary" %}} 팔코 버전 **0.14.0**부터 팔코 규칙은 팔코 엔진과 팔코 규칙 파일 모두의 명시적인 버전 관리를 지원한다. -{{< /info >}} +{{% /pageinfo %}} ### 팔코 엔진 버저닝 diff --git a/content/ko/docs/third-party.md b/content/ko/docs/third-party.md index 7cfe04219..cfad9f659 100644 --- a/content/ko/docs/third-party.md +++ b/content/ko/docs/third-party.md @@ -98,11 +98,11 @@ falco-driver-loader eBPF 는 현재 GKE 와 COS 만 지원하지만, 여기에서는 다양한 플랫폼에 대한 설치 세부 정보를 소개한다. -{{< info >}} +{{% pageinfo color="primary" %}} 프로브 파일의 대체 경로를 지정하려면, `FALCO_BPF_PROBE`를 기존 eBPF 프로브 경로로 설정할 수도 있다. -{{< /info >}} +{{% /pageinfo %}} 공식 컨테이너 이미지 사용 시 이 환경 변수를 설정하면, `falco-driver-loader` 스크립트가 실행되어 적절한 버전의 COS 커널 헤더를 다운로드한 다음 적절한 eBPF 프로브를 컴파일한다. 다른 모든 환경에서는 다음 방법으로 `falco-driver-loader` 를 직접 실행할 수 있다. diff --git a/layouts/partials/navbar.html b/layouts/partials/navbar.html new file mode 100644 index 000000000..51f5539fc --- /dev/null +++ b/layouts/partials/navbar.html @@ -0,0 +1,33 @@ +{{ $cover := .HasShortcode "blocks/cover" }} + diff --git a/themes/falco-fresh/layouts/shortcodes/changelog.html b/layouts/shortcodes/changelog.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/changelog.html rename to layouts/shortcodes/changelog.html diff --git a/themes/falco-fresh/layouts/shortcodes/cheat.html b/layouts/shortcodes/cheat.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/cheat.html rename to layouts/shortcodes/cheat.html diff --git a/themes/falco-fresh/layouts/shortcodes/cheatsheet.html b/layouts/shortcodes/cheatsheet.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/cheatsheet.html rename to layouts/shortcodes/cheatsheet.html diff --git a/themes/falco-fresh/layouts/shortcodes/config.html b/layouts/shortcodes/config.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/config.html rename to layouts/shortcodes/config.html diff --git a/themes/falco-fresh/layouts/shortcodes/githubcode.html b/layouts/shortcodes/githubcode.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/githubcode.html rename to layouts/shortcodes/githubcode.html diff --git a/themes/falco-fresh/layouts/shortcodes/latest.html b/layouts/shortcodes/latest.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/latest.html rename to layouts/shortcodes/latest.html diff --git a/themes/falco-fresh/layouts/shortcodes/requirement.html b/layouts/shortcodes/requirement.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/requirement.html rename to layouts/shortcodes/requirement.html diff --git a/themes/falco-fresh/layouts/shortcodes/sha256sum.html b/layouts/shortcodes/sha256sum.html similarity index 100% rename from themes/falco-fresh/layouts/shortcodes/sha256sum.html rename to layouts/shortcodes/sha256sum.html diff --git a/themes/docsy b/themes/docsy new file mode 160000 index 000000000..d37156f67 --- /dev/null +++ b/themes/docsy @@ -0,0 +1 @@ +Subproject commit d37156f67eff5f223bd849a7edc4ecb74a8e2efc diff --git a/themes/falco-fresh/layouts/shortcodes/danger.html b/themes/falco-fresh/layouts/shortcodes/danger.html deleted file mode 100644 index 48eeaaed2..000000000 --- a/themes/falco-fresh/layouts/shortcodes/danger.html +++ /dev/null @@ -1 +0,0 @@ -{{ partial "admonition.html" (dict "type" "danger" "icon" "ban" "content" .Inner) }} diff --git a/themes/falco-fresh/layouts/shortcodes/info.html b/themes/falco-fresh/layouts/shortcodes/info.html deleted file mode 100644 index a3d4b9e75..000000000 --- a/themes/falco-fresh/layouts/shortcodes/info.html +++ /dev/null @@ -1 +0,0 @@ -{{ partial "admonition.html" (dict "type" "info" "icon" "info-circle" "content" .Inner) }} diff --git a/themes/falco-fresh/layouts/shortcodes/success.html b/themes/falco-fresh/layouts/shortcodes/success.html deleted file mode 100644 index 6fbcb3987..000000000 --- a/themes/falco-fresh/layouts/shortcodes/success.html +++ /dev/null @@ -1 +0,0 @@ -{{ partial "admonition.html" (dict "type" "success" "icon" "check-circle" "content" .Inner) }} diff --git a/themes/falco-fresh/layouts/shortcodes/warning.html b/themes/falco-fresh/layouts/shortcodes/warning.html deleted file mode 100644 index f462764cb..000000000 --- a/themes/falco-fresh/layouts/shortcodes/warning.html +++ /dev/null @@ -1 +0,0 @@ -{{ partial "admonition.html" (dict "type" "warning" "icon" "exclamation" "content" .Inner) }}